How to fix a hacked account?

For a personal Microsoft account, use Microsoft’s Sign-in Helper and then the Contact Support route it offers; a support agent can review the available recovery options but cannot manually send a reset code, reset the password, or change the account’s security details.^1^

Personal Microsoft account

Since requesting codes to the correct email address and phone has already failed, avoid repeatedly requesting more codes—excessive attempts can cause a temporary block.^2^

1. Open the official hacked-account recovery page and start the Sign-in Helper.^3^
2. Enter the affected account’s original email address or phone number.
3. Select the options indicating that the account was compromised and that the verification method does not work.
4. Follow the recovery option presented. The tool may offer an opportunity to contact an agent.

To request live support separately:

1. Go to Contact Microsoft Support.^1^
2. Enter Account recovery, then select Get Help.
3. Select Contact Support.
4. If product and category choices appear, select:
   • Other Products
   • Manage account security
   • Chat with a support agent in your web browser
5. If sign-in is required, use a different working Microsoft account.
6. Give the agent a separate, accessible email address for replies.

Prepare the original account address, previous passwords, approximate account-creation details, Xbox console/device information if applicable, and purchase or subscription details. Do not post passwords, recovery codes, receipts, or unfamiliar account addresses publicly.

If the recovery form is offered

Complete it from a device and location previously used with the account. Microsoft sends the result to the working contact address supplied on the form, normally within 24 hours. If verification fails, another submission can be made, up to twice per day.^4^

A critical limitation applies: Microsoft support personnel cannot bypass ownership verification, send password-reset links, or directly change account details. If two-step verification was enabled and none of its registered verification methods remain accessible, Microsoft states that support cannot bypass those methods.^4^

If this is a work or school account

Do not use the personal-account recovery form. Contact the organization’s IT administrator or help desk. Another Microsoft Entra administrator can inspect the user’s sign-in status and registered verification information; if the account is blocked from signing in, an administrator can check the user in Microsoft Entra ID → Users → user profile.^5^

Protect other accounts now

• Change the password of the email account used for recovery.
• Change passwords anywhere the same password was reused.
• Review that email account’s forwarding rules and recovery information.
• After regaining the Microsoft account, run a full malware scan before changing its password, then inspect connected accounts, forwarding, and automatic replies.^3^

References

1. Contact Microsoft customer support | Microsoft Support
2. Troubleshoot Microsoft verification code issues | Microsoft Support
3. How to recover a hacked or compromised Microsoft account
4. Help with the Microsoft account recovery form | Microsoft Support
5. You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication